Support Forum

Hi, Based on document, I try to download and install evaluation license. But I got the error message. Anyone can help to take a look at it? Thank you very much.  HQ-FW # execute vm-license-options account-id daxxxxx@gmail.comHQ-FW # execute vm-license-options account-password ayyyyyxHQ-FW # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yRequesting FortiCare Trial license, proxy:(null)Forticare response error 61.Failed to download VM license. HQ-FW # get system statVersion: FortiGate-VM64-KVM v7.2.4,build1396,230131 (GA.F)Virus-DB: 1.00000(2018-04-09 18:07)Extended DB: 1.00000(2018-04-09 18:07)Extreme DB: 1.00000(2018-04-09 18:07)AV AI/ML Model: 0.000

Hi, last week we updated our FG cluster to FG200F with 7.4.5.We had some problems but in general it seems quite OK. Only with SSL VPN we still have problems and we cnat get it functioning.1. Connecting with Local User it works fine, I get the certificate window and I can login, no prob!2. User from LDAP, connection to LDAP works fine, I can even test my credentials and OK but than connecting to the SSL VPN I dont geht the ceretificate pop up and after 48% I get Permission denied and -455We did the same as in all other FGs. We imported the same remote certificate and everywhere it works. We checked groups and everything and it should be OK.In System Events VPN I get:Action ssl-login-failReason sslvpn_login_unknown_user What else can we try? It seems like the FG is not checking the certificate and we try with "Require Client certificate" and without and no change  Thanks!

Good morning everyone,I am experiencing a problem in my environment. Sometimes the 60F firewalls in version 7.2.10 are losing communication with the LAN and the WAN remains normal. In the ping test, I do not have continuous feedback from the LAN and it remains like this, losing many packets, consequently I lose connectivity from the location where the fortigate is located. 

hello, On a Fortinet vdom I need to migrate current SSL VPN with LDAP Auth to Azure SAML Auth.There are LDAP Auth UserGruups, every UserGroup is mapped to a single VPN SSL Portal.What I need to achieve is to set up Azure SAML Auth and map new User Groups to the same VPN Portals. UserGroup-1-LDAP -> Portal-VPN-SSL-1UserGroup-1-SAML-AZURE -> Portal-VPN-SSL-1 Is it possible without compromise or modify actual VPN SSL Portal configuration? Thanks a lot, Graziano 

So i recently set up an Authentik radius server it works properly as tested by radtest and NTRadPing   Authentik itself also returns "accept" when asked by fortigate But fortigate refuses to acknowledge that anything is properly configured  debug response:RTR-032 # diagnose test authserver radius VFX_Authentik pap test testauthenticate 'test' against 'pap' failed, assigned_rad_session_id=103199522320389 session_timeout=0 secs idle_timeout=0 secs!Does anyone have any idea what could be wrong?

Trying to register a FortiGate 60F Firmware 6.4.6, clicked Register, Login, filled-in Email, Password, and Country, but the Reseller field has no drop-down.How do I register?

Many moons ago, when I was first learning FortiGate firewalls, I was taught to use the VPN IPsec Wizard to create the initial VPN but then convert the tunnel from a "Site to Site - FortiGate" tunnel to a "Custom Tunnel".  At the time I wasn't doing many VPN connections to other FortiGates, so that is always the way I've built a tunnel.  Now, I'm doing more FortiGate to FortiGate VPN connections and I'm wondering if the "Site to Site - FortiGate" tunnel template is "better" for FortiGate to FortiGate connections?  It seems like using the "Site to Site - FortiGate" on each side reduces the chances of misconfiguration but perhaps it's also a security concern?  Either works for me, I'm just curious if one or the other is considered "better" or if it's just sort of "dealers choice".TIA!*****EDIT*****There seems to be some misunderstanding with what my question is.  Let me try and clarify.  When creating a FortiGate to FortiGate VPN using the IPse

Hi FG admins From this tech tip:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Most-common-cases-of-SIP-implementation/ta-p/190676 I have this scenario (phones behind NAT): Did all the required config, and even more:config system settings set sip-expectation disable set sip-nat-trace disable set default-voip-alg-mode kernel-helper-basedendconfig system session-helper delete 13endconfig voip profile edit "default" config sip set rtp disable set contact-fixup disable end end... Played with the above parameters and FG reboot but didn't work. I mean I have this behavior:Calling from internal IP phone to external mobile cell phone (GSM): It rings but no voiceCalling from internal IP phone to internal IP phone: IP phone doesn't even ringIn the traffic logs I could see some "TCP reset from server" on SIP connections.So I'm starting to think that probably on server side must be somehow configured to accept calls from IP phones behind NAT. Anyone knows somet

 I'm having an hard time to forward internet traffic over IPsec tunnel for specific subnets, basically i want that computers in the siteB subtnet access the internet though SiteB gateway via the IPsec tunnel. This is the official documentation: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Forward-internet-traffic-over-IPsec-tunnel-for/ta-p/328628 First of all it's poorly explained how to add the gateway to the phase 2 selectors (Note: make sure to include the gateway IP in phase 2 selectors of the tunnel to allow traffic) Can someone more advanced that me explain how to do it? Many thanks 

Hi, since this connection is new for us we dont have a lot of experience. The headquarter is in EU with 200F 7.4.5 and the new office is in the US 100F 7.4.5. Users are working with IPSec between the FGs and working on File Servers. In the HQ we use dedicated 1/1GB access for this VPN and in the US we have 1/1GB for all traffic for this >30 users. First thing, one week they dont complain at all, than another week all users complain every day. Checking our internet access we never find a problem. There it is more complicated since there is no technician but doing speedtest on pages in Europe he downloads test files with 1GB almost as fast as we do here. When it is getting really bad, they say e.g that working on a Terminal Server in our HG the mouse moves really, really slow. Than we started doing testing with iperf and with VIPs on both sides to the iperf server. We tried also from other FGs in Europe to our HQ and we got always > 300-500mb to this iperf server beh

Hello experts, I want to implement SAML authentication for some web application.The trick is that, I need the on-prem users, who already signed in to their domain accounts to be given the assertion directly without being re-directed to a login form. I did integrate FAC with the DC using "windows event log " method. Is there anyway to link a user who is redirected through SAML to FAC by his IP address with a user that already has an SSO session, so that the user is not prompt to actively login again?  

Hello, I have a multisite(a,b,c,d) Fortigate setup and plan on turning on Site-to-Site VPN.That part is fairly straight forward.  I also plan to connect one of my sites(a) to AWS via a site-to-site VPN. Will it be possible to have sites b,c,d talk to AWS via the tunnel at site a?I want to avoid connecting all FortiGate sites to AWS, as AWS charges per VPN connection. Thanks for any information  

What is the user limit of the FortiAnalyzer-100C device? Is there any supporting documentation?

i have enabled syslog logging for 1x FG100E and 1 x FG100F.but the log collector does not seems to receive any logs from these 2.Only the main firewall FG401E is able to send logs to the log collector without issues.is there any limitations for FG100 series ?

Hi,I am now facing an issue. My internet connection is using pppoe with dynamic ipv6 prefix.Device: fortigate 60eFirmware: 7.4.7 When my pppoe connection is disconnected, reconnected or other reasons causing this interface down. After a few seconds, pppoe connection is up again, fortigate gets a new PD /60 range from ISP and delegates new IPs to internal devices.PCs are assgined a new ip separately, but the old one is still existed, and contiune to use the old one to initiate new connections.I find some information using below command, these are two Windows devices:Actually the first(already deprecated, waited for 48 hours ), second, and third addresses are invalid, but the second, third ones are still in 首选寿命(preferred state),  Windows still uses it to initiate new connections.  netsh interface ipv6 show addresses 接口 3: vEthernet (VLAN101) 地址类型 DAD 状态 有效寿命 首选寿命 地址 --------- ----------- ---------- ---------- ------------------------ 公用 反对

Fortianalyzer running on v7.2.9 facing issue related to logs are not being deleted.IN the Data policy - Keep Logs for Analytics is 60 days & Keep Logs for Archive is 365 DAys. I have enable auto deletion under file management - delete file older than 365 days. but in the storage info, i see in the Archive(actual/config days) - 683/365 days... As per the config it should delete the archive logs older than 365 days but it didnt instead showing 683 days.. if i check in the log browse, it shows only last 3 months of archive data...  please guide me on this - How to delete the archive logs older than 365 days and why the automatic deletion not working... FortiAnalyzer  PFA

I am having trouble deleting an Access Point on the FortiWLC 8.4-3build-4 | FortiWLC-500D The error message reads as follows:ERROR: Ap is being used by a Service Connect's Location Profile. Any tips would be great.

Good day,I need an explanation or on the contrary a solution to the following problem(Note: I am an amateur in this world and my English is not very good)  I have a machine with IP 192.168.1.10, I also have two ISP channels, these are located within the virtual-wan-link SDWAN zone and finally I have a rule for the Internet output of the mentioned machine When reviewing the machine's traffic, it is evident that its output is being generated through my first Internet channel and in addition, packets are seen sent but not received by the destinations, that is, web pages. As a solution to this problem, an SDWAN rule was created so that all traffic to the Internet from said machine was carried out through my second Internet channel, which generated an effective response, that is, packets sent by the source (Machine) were shown as packets received by the destination (Web pages).  We consulted with the provider of our first internet channel to determine if the public

I would like to permit only screenconnect (cloud hosted) on a computer that is in network. This computer does not need internet but we would like to be able to connect to it remotely via screenconnect in case of troubleshoot. We already do this at another site but with logmein (similar product) and it works perfectly but in that case I can select all the logmein destination (internet service) but there's is no screenconnect or connectwise entry in the internet service section on the fortigate. Is there any way that I could do this?

Dear All, I am experiencing an issue with the built-in SSL VPN on Windows 11 version 24H2. While the VPN connection is successfully established, no traffic is received on the FortiGate when attempting to access applications through the VPN. We suspect the issue may be related to FortiClient.  We are using the FortiClient application from the Microsoft Store: Notably, I have tested the same setup on Windows 11 version 23H11, and no issues were encountered. Please advise on how to proceed with troubleshooting this issue.Best regards,     

Dear TAC Team,I am experiencing difficulty locating the downloaded database from FortiClient EMS. While the GUI indicates that the database was downloaded and saved at a specific time, I am unable to determine the exact directory or repository where it is stored. Unlike FortiGate, the database does not appear in the browser's default download directory. Could you please provide guidance on the standard directory or repository where the database is saved by default? Additionally, any steps to locate or configure the backup path would be greatly appreciated.Thank you for your assistance.

I am looking thru our security report and see an instance of botnet detected under the threats category.  does this mean it was detected and cleaned? does this mean we have an infected machine? what is the best course of action here?

HiWe hope this board has some java developer as well:We developed a Java based RADIUS server but since firmware 7.2.10 customers experience issue.We know, we have to include the Message-Authenticator Attribute (80) in the response package. To generate the Message-Authenticator, we use the following Java-code:    public static byte[] generateMessageAuthenticator3(byte[] sharedSecret, int packetCode, int packetIdentifier, int packetLength, byte[] requestAuthenticator, byte[] attributes) { try { Mac mac = Mac.getInstance("HmacMD5"); mac.init(new SecretKeySpec(sharedSecret, "HmacMD5")); mac.update((byte) packetCode); mac.update((byte) packetIdentifier); mac.update((byte) (packetLength >> 8)); mac.update((byte) (packetLength & 0x0ff)); mac.update(requestAuthenticator, 0, requestAuthenticator.length); mac.update(attributes, 0, attributes.length); return mac.doFinal(); } catch (NoSuchAlgorithmException ex) { ex.printStackTrace();

Hi all,Do I need to configure/enable ECMP for OSPF or does it work by default? I know that it needs to be enabled for BGP.I have the below scenario with OSPF between all 4 firewalls.Currently using statics for 3 to get to 4 and 4 to 3, as there are 2 equal cost paths.If I remove the statics will the Fortigates be load balancing over the 2 paths or do I need to enable something on ECMP or OSPF? I was worried about asymmetric routing.  

Working on a project that is going to involve around 150 site-to-site IPsec tunnels.  Near end is a FortiGate 300E.  Remote ends are Digi TX64 cellular routers installed on transit buses.  IPsec setup is straightforward enough. The issue is all of the buses use identical numbering schemes on a 192.168.x.0/24 network. In other words, the same device on every bus will be 192.168.x.100.  Because of the way the Digi routers handle NAT configuration, it is highly preferable to handle all of the required NAT operations on the FortiGate end. SNAT for the traffic coming into the FortiGate works well enough, 192.168.x.100 becomes 10.x.x.100 and goes on to it's destination on the internal network according to a flow trace.  The problem I'm up against is the response packets from the internal server get back to the FortiGate, DNAT converts them back to 192.168.x.0 addresses, and then the FortiGate doesn't know how to route them. We do have a route configure